chef 18.9.4 → 18.11.11

data/lib/chef/resource/chef_client_config.rb

@@ -23,79 +23,129 @@ class Chef
 
       provides :chef_client_config
 
+      DIRECTORY_SPEC_DEFAULTS = {
+        config: { mode: "0750", inherits: :auto },
+        client_d: { mode: "0750", inherits: :auto },
+        logs: { mode: "0755", inherits: :auto },
+        cache: { mode: "0750", inherits: :auto },
+        backups: { mode: "0750", inherits: :auto },
+      }.freeze
+
       description "Use the **chef_client_config** resource to create a client.rb file in the #{ChefUtils::Dist::Infra::PRODUCT} configuration directory. See the [client.rb docs](https://docs.chef.io/config_rb_client/) for more details on options available in the client.rb configuration file."
       introduced "16.6"
       examples <<~DOC
-      **Bare minimum #{ChefUtils::Dist::Infra::PRODUCT} client.rb**:
-
-      The absolute minimum configuration necessary for a node to communicate with the #{ChefUtils::Dist::Server::PRODUCT} is the URL of the #{ChefUtils::Dist::Server::PRODUCT}. All other configuration options either have values at the server side (Policyfiles, Roles, Environments, etc) or have default values determined at client startup.
+        **Bare minimum #{ChefUtils::Dist::Infra::PRODUCT} client.rb**:
 
-      ```ruby
-      chef_client_config 'Create client.rb' do
-        chef_server_url 'https://chef.example.dmz'
-      end
-      ```
-
-      **More complex #{ChefUtils::Dist::Infra::PRODUCT} client.rb**:
-
-      ```ruby
-      chef_client_config 'Create client.rb' do
-        chef_server_url 'https://chef.example.dmz'
-        log_level :info
-        log_location :syslog
-        http_proxy 'proxy.example.dmz'
-        https_proxy 'proxy.example.dmz'
-        no_proxy %w(internal.example.dmz)
-      end
-      ```
-
-      **Adding additional config content to the client.rb**:
-
-      This resource aims to provide common configuration options. Some configuration options are missing and some users may want to use arbitrary Ruby code within their configuration. For this we offer an `additional_config` property that can be used to add any configuration or code to the bottom of the `client.rb` file. Also keep in mind that within the configuration directory is a `client.d` directory where you can put additional `.rb` files containing configuration options. These can be created using `file` or `template` resources within your cookbooks as necessary.
-
-      ```ruby
-      chef_client_config 'Create client.rb' do
-        chef_server_url 'https://chef.example.dmz'
-        additional_config <<~CONFIG
-          # Extra config code to safely load a gem into the client run.
-          # Since the config is Ruby you can run any Ruby code you want via the client.rb.
-          # It's a great way to break things, so be careful
-          begin
-            require 'aws-sdk'
-          rescue LoadError
-            Chef::Log.warn "Failed to load aws-sdk."
-          end
-        CONFIG
-      end
-      ```
+        The absolute minimum configuration necessary for a node to communicate with the #{ChefUtils::Dist::Server::PRODUCT} is the URL of the #{ChefUtils::Dist::Server::PRODUCT}. All other configuration options either have values at the server side (Policyfiles, Roles, Environments, etc) or have default values determined at client startup.
 
-      **Setup two report handlers in the client.rb**:
-
-      ```ruby
-      chef_client_config 'Create client.rb' do
-        chef_server_url 'https://chef.example.dmz'
-        report_handlers [
-          {
-           'class' => 'ReportHandler1Class',
-           'arguments' => ["'FirstArgument'", "'SecondArgument'"],
-          },
-          {
-           'class' => 'ReportHandler2Class',
-           'arguments' => ["'FirstArgument'", "'SecondArgument'"],
-          },
-        ]
-      end
-      ```
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+        end
+        ```
+
+        **More complex #{ChefUtils::Dist::Infra::PRODUCT} client.rb**:
+
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+          log_level :info
+          log_location :syslog
+          http_proxy 'proxy.example.dmz'
+          https_proxy 'proxy.example.dmz'
+          no_proxy %w(internal.example.dmz)
+        end
+        ```
+
+        **Adding additional config content to the client.rb**:
+
+        This resource aims to provide common configuration options. Some configuration options are missing and some users may want to use arbitrary Ruby code within their configuration. For this we offer an `additional_config` property that can be used to add any configuration or code to the bottom of the `client.rb` file. Also keep in mind that within the configuration directory is a `client.d` directory where you can put additional `.rb` files containing configuration options. These can be created using `file` or `template` resources within your cookbooks as necessary.
+
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+          additional_config <<~CONFIG
+            # Extra config code to safely load a gem into the client run.
+            # Since the config is Ruby you can run any Ruby code you want via the client.rb.
+            # It's a great way to break things, so be careful
+            begin
+              require 'aws-sdk'
+            rescue LoadError
+              Chef::Log.warn "Failed to load aws-sdk."
+            end
+          CONFIG
+        end
+        ```
+
+        **Setup two report handlers in the client.rb**:
+
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+          report_handlers [
+            {
+              'class' => 'ReportHandler1Class',
+              'arguments' => ["'FirstArgument'", "'SecondArgument'"],
+            },
+            {
+              'class' => 'ReportHandler2Class',
+              'arguments' => ["'FirstArgument'", "'SecondArgument'"],
+            },
+          ]
+        end
+        ```
 
-      **Report directly to the [Chef Automate data collector endpoint](/automate/data_collection/#configure-chef-infra-client-to-use-the-data-collector-endpoint-in-chef-automate).**
+        **Report directly to the [Chef Automate data collector endpoint](/automate/data_collection/#configure-chef-infra-client-to-use-the-data-collector-endpoint-in-chef-automate).**
 
-      ```ruby
-      chef_client_config 'Create client.rb' do
-        chef_server_url 'https://chef.example.dmz'
-        data_collector_server_url 'https://automate.example.dmz'
-        data_collector_token 'TEST_TOKEN_TEST'
-      end
-      ```
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+          data_collector_server_url 'https://automate.example.dmz'
+          data_collector_token 'TEST_TOKEN_TEST'
+        end
+        ```
+
+        **Set Linux directory ownership and modes**:
+
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+          user 'root'
+          group 'root'
+          file_cache_path '/var/chef/cache'
+          file_backup_path '/var/chef/backups'
+          log_location '/var/log/chef/client.log'
+          directory_specs(
+            config: { owner: 'root', group: 'root', mode: '0700' },
+            client_d: { owner: 'root', group: 'root', mode: '0700' },
+            logs: { owner: 'root', group: 'root', mode: '0750' },
+            cache: { owner: 'root', group: 'root', mode: '0750' },
+            backups: { owner: 'root', group: 'root', mode: '0750' }
+          )
+        end
+        ```
+
+        **Set Windows directory inheritance and rights**:
+
+        ```ruby
+        chef_client_config 'Create client.rb' do
+          chef_server_url 'https://chef.example.dmz'
+          config_directory 'C:/chef'
+          file_cache_path 'C:/chef/cache'
+          file_backup_path 'C:/chef/backups'
+          log_location 'C:/chef/log/client.log'
+          directory_specs(
+            config: {
+              owner: 'Administrators',
+              inherits: false,
+              rights: {
+                'Administrators' => :full_control,
+                'SYSTEM' => :full_control,
+              },
+            }
+          )
+        end
+        ```
       DOC
 
       # @todo policy_file or policy_group being set requires the other to be set so enforce that.
@@ -141,10 +191,10 @@ class Chef
         equal_to: %i{verify_none verify_peer},
         coerce: proc { |x| string_to_symbol(x) },
         description: <<~DESC
-        Set the verify mode for HTTPS requests.
+          Set the verify mode for HTTPS requests.
 
-        * Use :verify_none for no validation of SSL certificates.
-        * Use :verify_peer for validation of all SSL certificates, including the #{ChefUtils::Dist::Server::PRODUCT} connections, S3 connections, and any HTTPS remote_file resource URLs used in #{ChefUtils::Dist::Infra::PRODUCT} runs. This is the recommended setting.
+          * Use :verify_none for no validation of SSL certificates.
+          * Use :verify_peer for validation of all SSL certificates, including the #{ChefUtils::Dist::Server::PRODUCT} connections, S3 connections, and any HTTPS remote_file resource URLs used in #{ChefUtils::Dist::Infra::PRODUCT} runs. This is the recommended setting.
         DESC
 
       property :formatters, Array,
@@ -174,7 +224,7 @@ class Chef
         description: "The proxy server to use for HTTPS connections."
 
       property :ftp_proxy, String,
-      description: "The proxy server to use for FTP connections."
+        description: "The proxy server to use for FTP connections."
 
       property :no_proxy, [String, Array],
         description: "A comma-separated list or an array of URLs that do not need a proxy.",
@@ -254,21 +304,83 @@ class Chef
         description: "The data collector token to interact with the data collector server URL (Automate). Note: If possible, use Chef Infra Server to do all data collection reporting, as this removes the need to distribute tokens to individual nodes.",
         introduced: "17.8"
 
+      property :directory_specs, Hash,
+        description: <<~DESC,
+          Permission overrides for Chef-managed directories.
+          This must be a hash of hashes: top-level keys are directory names, values are per-directory option hashes.
+
+          Use this property like:
+            directory_specs(
+              config: { owner: "root", group: "root", mode: "0700" },
+              client_d: { owner: "root", group: "root", mode: "0700" },
+              logs: { owner: "root", group: "root", mode: "0700" },
+              cache: { owner: "root", group: "root", mode: "0700" },
+              backups: { owner: "root", group: "root", mode: "0700" }
+            )
+
+          Directory keys: :config, :client_d, :logs, :cache, :backups
+          Override keys: :owner, :group, :mode, :rights, :inherits (:rights and :inherits are Windows-only)
+        DESC
+        callbacks: {
+          "keys must be one of :config, :client_d, :logs, :cache, :backups" => lambda { |v|
+            valid_keys = %i{config client_d logs cache backups}
+            v.keys.all? { |k| valid_keys.include?(k) }
+          },
+          "values must be a hash with keys only from :owner, :group, :mode, :rights, :inherits" => lambda { |v|
+            valid_inner_keys = %i{owner group mode rights inherits}
+            v.values.all? { |value| value.is_a?(Hash) && value.keys.all? { |k| valid_inner_keys.include?(k) } }
+          },
+        },
+        default: DIRECTORY_SPEC_DEFAULTS,
+        coerce: proc { |v|
+          DIRECTORY_SPEC_DEFAULTS.merge(v) do |_key, base, override|
+            override.is_a?(Hash) ? base.merge(override) : override
+          end
+        }
+
+      property :client_rb_mode, String,
+        description: "The mode to set on the client.rb file that is written out by this resource (e.g., 0600).",
+        default: "0640"
+
       action :create, description: "Create a client.rb config file and folders for configuring #{ChefUtils::Dist::Infra::PRODUCT}." do
-        [
-          new_resource.config_directory,
-          (::File.dirname(new_resource.log_location) if new_resource.log_location.is_a?(String) && !%w{STDOUT STDERR}.include?(new_resource.log_location) && !new_resource.log_location.empty?),
-          new_resource.file_backup_path,
-          new_resource.file_cache_path,
-          ::File.join(new_resource.config_directory, "client.d"),
-          (::File.dirname(new_resource.pid_file) unless new_resource.pid_file.nil?),
-        ].compact.each do |dir_path|
-
-          directory dir_path do
-            user new_resource.user unless new_resource.user.nil?
-            group new_resource.group unless new_resource.group.nil?
-            mode dir_path == ::File.dirname(new_resource.log_location.to_s) ? "0755" : "0750"
-            recursive true
+        # The logs directory is derived from log_location, which may be a symbol
+        # or a stream name (STDOUT/STDERR) rather than a file path. Only raise if
+        # the user customized logs specs but log_location is not a usable file path.
+        if new_resource.directory_specs[:logs] != DIRECTORY_SPEC_DEFAULTS[:logs] && log_directory.nil?
+          raise ArgumentError, "Invalid directory_specs: logs requires :logs (file path)"
+        end
+
+        # Build path map for each managed directory. For cache and backups, fall
+        # back to ChefConfig defaults when not explicitly set so that directory_specs
+        # overrides are applied even if the user didn't configure a custom path in client.rb.
+        spec_paths = {
+          config: new_resource.config_directory,
+          client_d: ::File.join(new_resource.config_directory, "client.d"),
+          logs: log_directory,
+          cache: new_resource.file_cache_path || ChefConfig::Config.file_cache_path,
+          backups: new_resource.file_backup_path || ChefConfig::Config.file_backup_path,
+        }
+
+        # Build directory specs based on user input and defaults
+        specs = {}
+        new_resource.directory_specs.each do |key, overrides|
+          path = spec_paths[key]
+          next if path.nil?
+
+          specs[key] = DirectorySpec.new(
+            path: path,
+            owner: overrides[:owner] || new_resource.user,
+            group: overrides[:group] || new_resource.group,
+            mode: overrides[:mode],
+            rights: overrides[:rights],
+            inherits: overrides[:inherits]
+          )
+        end
+
+        # Converge directories
+        specs.each_value do |spec|
+          directory spec.path do
+            spec.apply(self)
           end
         end
 
@@ -309,7 +421,7 @@ class Chef
             data_collector_server_url: new_resource.data_collector_server_url,
             data_collector_token: new_resource.data_collector_token
           )
-          mode "0640"
+          mode new_resource.client_rb_mode
           action :create
         end
       end
@@ -329,13 +441,63 @@ class Chef
         # @return [Array] Array of handler data
         #
         def format_handler(handler_property)
-          handler_data = []
+          handler_data = handler_property.map do |handler|
+            "#{handler["class"]}.new(#{handler["arguments"].join(",")})"
+          end
+        end
+
+        # A helper class to encapsulate directory spec data and application logic for both *nix and Windows.
+        # This allows us to keep the logic for how to apply permissions to directories in one place and makes it easier to test.
+        class DirectorySpec
+          attr_reader :path, :owner, :group, :mode, :rights, :inherits
+
+          def initialize(path:, owner: nil, group: nil, mode: nil, rights: nil, inherits: :auto)
+            @path   = path
+            @owner  = owner
+            @group  = group
+            @mode   = mode
+            @rights = rights
+            @inherits = inherits
+          end
+
+          def windows?
+            Chef::Platform.windows?
+          end
 
-          handler_property.each do |handler|
-            handler_data << "#{handler["class"]}.new(#{handler["arguments"].join(",")})"
+          def apply(resource)
+            resource.recursive true
+
+            if windows?
+              if rights && !rights.empty?
+                resource.inherits(inherits == :auto ? false : inherits)
+
+                rights.each do |principal, permission|
+                  resource.rights(permission, principal)
+                end
+              else
+                # Ensure defaults can restore inherited ACL behavior after custom rights were applied.
+                resource.inherits(inherits == :auto ? true : inherits)
+                resource.mode(mode) if mode
+              end
+
+              resource.owner(owner) if owner
+            else
+              resource.owner(owner) if owner
+              resource.group(group) if group
+              resource.mode(mode) if mode
+            end
           end
+        end
+
+        # A helper method to determine the directory to apply log permissions to based on the log_location property.
+        # If log_location is a file path, this returns the directory containing that file.
+        # If log_location is not a file path (e.g., it's a symbol for syslog or win_evt, or it's STDOUT/STDERR),
+        # this returns nil since there is no directory to apply permissions to.
+        def log_directory
+          return unless new_resource.log_location.is_a?(String)
+          return if %w{STDOUT STDERR}.include?(new_resource.log_location)
 
-          handler_data
+          ::File.dirname(new_resource.log_location)
         end
       end
     end

data/lib/chef/resource/chef_client_cron.rb

@@ -28,28 +28,28 @@ class Chef
       description "Use the **chef_client_cron** resource to setup the #{ChefUtils::Dist::Infra::PRODUCT} to run as a cron job. This resource will also create the specified log directory if it doesn't already exist."
       introduced "16.0"
       examples <<~DOC
-      **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
+        **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
 
-      ```ruby
-      chef_client_cron 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a cron job'
-      ```
+        ```ruby
+        chef_client_cron 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a cron job'
+        ```
 
-      **Run #{ChefUtils::Dist::Infra::PRODUCT} twice a day**:
+        **Run #{ChefUtils::Dist::Infra::PRODUCT} twice a day**:
 
-      ```ruby
-      chef_client_cron 'Run #{ChefUtils::Dist::Infra::PRODUCT} every 12 hours' do
-        minute 0
-        hour '0,12'
-      end
-      ```
+        ```ruby
+        chef_client_cron 'Run #{ChefUtils::Dist::Infra::PRODUCT} every 12 hours' do
+          minute 0
+          hour '0,12'
+        end
+        ```
 
-      **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
+        **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
 
-      ```ruby
-      chef_client_cron 'Run an override recipe' do
-        daemon_options ['--override-runlist mycorp_base::default']
-      end
-      ```
+        ```ruby
+        chef_client_cron 'Run an override recipe' do
+          daemon_options ['--override-runlist mycorp_base::default']
+        end
+        ```
       DOC
 
       extend Chef::ResourceHelpers::CronValidations
@@ -141,7 +141,7 @@ class Chef
         description: "The process priority to run the #{ChefUtils::Dist::Infra::CLIENT} process at. A value of -20 is the highest priority and 19 is the lowest priority.",
         introduced: "16.5",
         coerce: proc { |x| Integer(x) },
-        callbacks: { "should be an Integer between -20 and 19" => proc { |v| v >= -20 && v <= 19 } }
+        callbacks: { "should be an Integer between -20 and 19" => proc { |v| v.between?(-20, 19) } }
 
       action :add, description: "Add a cron job to run #{ChefUtils::Dist::Infra::PRODUCT}." do
         # TODO: Replace this with a :create_if_missing action on directory when that exists

data/lib/chef/resource/chef_client_launchd.rb

@@ -94,7 +94,7 @@ class Chef
       property :nice, [Integer, String],
         description: "The process priority to run the #{ChefUtils::Dist::Infra::CLIENT} process at. A value of -20 is the highest priority and 19 is the lowest priority.",
         coerce: proc { |x| Integer(x) },
-        callbacks: { "should be an Integer between -20 and 19" => proc { |v| v >= -20 && v <= 19 } }
+        callbacks: { "should be an Integer between -20 and 19" => proc { |v| v.between?(-20, 19) } }
 
       property :low_priority_io, [true, false],
         description: "Run the #{ChefUtils::Dist::Infra::CLIENT} process with low priority disk IO",

data/lib/chef/resource/chef_client_scheduled_task.rb

@@ -26,45 +26,45 @@ class Chef
       description "Use the **chef_client_scheduled_task** resource to setup the #{ChefUtils::Dist::Infra::PRODUCT} to run as a Windows scheduled task. This resource will also create the specified log directory if it doesn't already exist."
       introduced "16.0"
       examples <<~DOC
-      **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
+        **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
 
-      ```ruby
-      chef_client_scheduled_task 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a scheduled task'
-      ```
+        ```ruby
+        chef_client_scheduled_task 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a scheduled task'
+        ```
 
-      **Run #{ChefUtils::Dist::Infra::PRODUCT} on system start**:
+        **Run #{ChefUtils::Dist::Infra::PRODUCT} on system start**:
 
-      ```ruby
-      chef_client_scheduled_task '#{ChefUtils::Dist::Infra::PRODUCT} on start' do
-        frequency 'onstart'
-      end
-      ```
+        ```ruby
+        chef_client_scheduled_task '#{ChefUtils::Dist::Infra::PRODUCT} on start' do
+          frequency 'onstart'
+        end
+        ```
 
-      **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
+        **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
 
-      ```ruby
-      chef_client_scheduled_task 'Run an override recipe' do
-        daemon_options ['--override-runlist mycorp_base::default']
-      end
-      ```
+        ```ruby
+        chef_client_scheduled_task 'Run an override recipe' do
+          daemon_options ['--override-runlist mycorp_base::default']
+        end
+        ```
 
-      **Run #{ChefUtils::Dist::Infra::PRODUCT} daily at 01:00 am, specifying a named run-list**:
+        **Run #{ChefUtils::Dist::Infra::PRODUCT} daily at 01:00 am, specifying a named run-list**:
 
-      ```ruby
-      chef_client_scheduled_task 'Run chef-client named run-list daily' do
-        frequency 'daily'
-        start_time '01:00'
-        daemon_options ['-n audit_only']
-      end
-      ```
+        ```ruby
+        chef_client_scheduled_task 'Run chef-client named run-list daily' do
+          frequency 'daily'
+          start_time '01:00'
+          daemon_options ['-n audit_only']
+        end
+        ```
 
-      **Run #{ChefUtils::Dist::Infra::PRODUCT} with a persistent delay on every run calculated once, similar to how chef_client_cron resource works**:
+        **Run #{ChefUtils::Dist::Infra::PRODUCT} with a persistent delay on every run calculated once, similar to how chef_client_cron resource works**:
 
-      ```ruby
-      chef_client_scheduled_task 'Run chef-client with persistent splay' do
-        use_consistent_splay true
-      end
-      ```
+        ```ruby
+        chef_client_scheduled_task 'Run chef-client with persistent splay' do
+          use_consistent_splay true
+        end
+        ```
       DOC
 
       resource_name :chef_client_scheduled_task
@@ -145,7 +145,7 @@ class Chef
       property :priority, Integer,
         description: "Use to set Priority Levels range from 0 to 10.",
         introduced: "17.5",
-        default: 7, callbacks: { "should be in range of 0 to 10" => proc { |v| v >= 0 && v <= 10 } }
+        default: 7, callbacks: { "should be in range of 0 to 10" => proc { |v| v.between?(0, 10) } }
 
       action :add, description: "Add a Windows Scheduled Task that runs #{ChefUtils::Dist::Infra::PRODUCT}." do
         # TODO: Replace this with a :create_if_missing action on directory when that exists

data/lib/chef/resource/chef_client_systemd_timer.rb

@@ -26,27 +26,27 @@ class Chef
       description "Use the **chef_client_systemd_timer** resource to setup the #{ChefUtils::Dist::Infra::PRODUCT} to run as a systemd timer."
       introduced "16.0"
       examples <<~DOC
-      **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
+        **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
 
-      ```ruby
-      chef_client_systemd_timer 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a systemd timer'
-      ```
+        ```ruby
+        chef_client_systemd_timer 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a systemd timer'
+        ```
 
-      **Run #{ChefUtils::Dist::Infra::PRODUCT} every 1 hour**:
+        **Run #{ChefUtils::Dist::Infra::PRODUCT} every 1 hour**:
 
-      ```ruby
-      chef_client_systemd_timer 'Run #{ChefUtils::Dist::Infra::PRODUCT} every 1 hour' do
-        interval '1hr'
-      end
-      ```
+        ```ruby
+        chef_client_systemd_timer 'Run #{ChefUtils::Dist::Infra::PRODUCT} every 1 hour' do
+          interval '1hr'
+        end
+        ```
 
-      **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
+        **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
 
-      ```ruby
-      chef_client_systemd_timer 'Run an override recipe' do
-        daemon_options ['--override-runlist mycorp_base::default']
-      end
-      ```
+        ```ruby
+        chef_client_systemd_timer 'Run an override recipe' do
+          daemon_options ['--override-runlist mycorp_base::default']
+        end
+        ```
       DOC
 
       property :job_name, String,

data/lib/chef/resource/chef_client_trusted_certificate.rb

@@ -26,35 +26,35 @@ class Chef
       description "Use the **chef_client_trusted_certificate** resource to add certificates to #{ChefUtils::Dist::Infra::PRODUCT}'s trusted certificate directory. This allows the #{ChefUtils::Dist::Infra::PRODUCT} to communicate with internal encrypted resources without errors."
       introduced "16.5"
       examples <<~DOC
-      **Trust a self signed certificate**:
+        **Trust a self signed certificate**:
 
-      ```ruby
-      chef_client_trusted_certificate 'self-signed.badssl.com' do
-        certificate <<~CERT
-        -----BEGIN CERTIFICATE-----
-        MIIDeTCCAmGgAwIBAgIJAPziuikCTox4MA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNV
-        BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
-        c2NvMQ8wDQYDVQQKDAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTAeFw0x
-        OTEwMDkyMzQxNTJaFw0yMTEwMDgyMzQxNTJaMGIxCzAJBgNVBAYTAlVTMRMwEQYD
-        VQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ8wDQYDVQQK
-        DAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEB
-        BQADggEPADCCAQoCggEBAMIE7PiM7gTCs9hQ1XBYzJMY61yoaEmwIrX5lZ6xKyx2
-        PmzAS2BMTOqytMAPgLaw+XLJhgL5XEFdEyt/ccRLvOmULlA3pmccYYz2QULFRtMW
-        hyefdOsKnRFSJiFzbIRMeVXk0WvoBj1IFVKtsyjbqv9u/2CVSndrOfEk0TG23U3A
-        xPxTuW1CrbV8/q71FdIzSOciccfCFHpsKOo3St/qbLVytH5aohbcabFXRNsKEqve
-        ww9HdFxBIuGa+RuT5q0iBikusbpJHAwnnqP7i/dAcgCskgjZjFeEU4EFy+b+a1SY
-        QCeFxxC7c3DvaRhBB0VVfPlkPz0sw6l865MaTIbRyoUCAwEAAaMyMDAwCQYDVR0T
-        BAIwADAjBgNVHREEHDAaggwqLmJhZHNzbC5jb22CCmJhZHNzbC5jb20wDQYJKoZI
-        hvcNAQELBQADggEBAGlwCdbPxflZfYOaukZGCaxYK6gpincX4Lla4Ui2WdeQxE95
-        w7fChXvP3YkE3UYUE7mupZ0eg4ZILr/A0e7JQDsgIu/SRTUE0domCKgPZ8v99k3A
-        vka4LpLK51jHJJK7EFgo3ca2nldd97GM0MU41xHFk8qaK1tWJkfrrfcGwDJ4GQPI
-        iLlm6i0yHq1Qg1RypAXJy5dTlRXlCLd8ufWhhiwW0W75Va5AEnJuqpQrKwl3KQVe
-        wGj67WWRgLfSr+4QG1mNvCZb2CkjZWmxkGPuoP40/y7Yu5OFqxP5tAjj4YixCYTW
-        EVA0pmzIzgBg+JIe3PdRy27T0asgQW/F4TY61Yk=
-        -----END CERTIFICATE-----
-        CERT
-      end
-      ```
+        ```ruby
+        chef_client_trusted_certificate 'self-signed.badssl.com' do
+          certificate <<~CERT
+          -----BEGIN CERTIFICATE-----
+          MIIDeTCCAmGgAwIBAgIJAPziuikCTox4MA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNV
+          BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
+          c2NvMQ8wDQYDVQQKDAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTAeFw0x
+          OTEwMDkyMzQxNTJaFw0yMTEwMDgyMzQxNTJaMGIxCzAJBgNVBAYTAlVTMRMwEQYD
+          VQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ8wDQYDVQQK
+          DAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEB
+          BQADggEPADCCAQoCggEBAMIE7PiM7gTCs9hQ1XBYzJMY61yoaEmwIrX5lZ6xKyx2
+          PmzAS2BMTOqytMAPgLaw+XLJhgL5XEFdEyt/ccRLvOmULlA3pmccYYz2QULFRtMW
+          hyefdOsKnRFSJiFzbIRMeVXk0WvoBj1IFVKtsyjbqv9u/2CVSndrOfEk0TG23U3A
+          xPxTuW1CrbV8/q71FdIzSOciccfCFHpsKOo3St/qbLVytH5aohbcabFXRNsKEqve
+          ww9HdFxBIuGa+RuT5q0iBikusbpJHAwnnqP7i/dAcgCskgjZjFeEU4EFy+b+a1SY
+          QCeFxxC7c3DvaRhBB0VVfPlkPz0sw6l865MaTIbRyoUCAwEAAaMyMDAwCQYDVR0T
+          BAIwADAjBgNVHREEHDAaggwqLmJhZHNzbC5jb22CCmJhZHNzbC5jb20wDQYJKoZI
+          hvcNAQELBQADggEBAGlwCdbPxflZfYOaukZGCaxYK6gpincX4Lla4Ui2WdeQxE95
+          w7fChXvP3YkE3UYUE7mupZ0eg4ZILr/A0e7JQDsgIu/SRTUE0domCKgPZ8v99k3A
+          vka4LpLK51jHJJK7EFgo3ca2nldd97GM0MU41xHFk8qaK1tWJkfrrfcGwDJ4GQPI
+          iLlm6i0yHq1Qg1RypAXJy5dTlRXlCLd8ufWhhiwW0W75Va5AEnJuqpQrKwl3KQVe
+          wGj67WWRgLfSr+4QG1mNvCZb2CkjZWmxkGPuoP40/y7Yu5OFqxP5tAjj4YixCYTW
+          EVA0pmzIzgBg+JIe3PdRy27T0asgQW/F4TY61Yk=
+          -----END CERTIFICATE-----
+          CERT
+        end
+        ```
       DOC
 
       property :cert_name, String, name_property: true,